UEFI modules analysing with BinDiff IDA plugin

Table of Contents

• Introduction
• Software
• Usage
  • i64 files generation
  • Analysing release versions of UEFI images with BinDiff IDA plugin
• Conclusion

Introduction

In fact, most real UEFI firmwares are building using edk2. Thus, to simplify the analysis, we can match debug versions of UEFI images with release versions from real firmware using BinDiff.

Software

• IDA Pro
• BinDiff with IDA Pro plugin

Usage

i64 files generation

• clone this repo and update submodules

  git clone https://github.com/yeggor/UEFI_BinDiff
  cd UEFI_BinDiff
  git submodule update --init --recursive

• copy analyse_and_exit.py script to idc IDA directory (for example: C:\Program Files\IDA Pro 7.5\idc)

• check values in config.json file

• build efi modules with debug information

  • open Developer Command Prompt for VS
  • run python edk2_build.py from UEFI_BinDiff directory
  • if everything went well, you should see the efi_modules directory with .efi files
  • otherwise, you need to look for the reason here

• run python gen_idbs.py efi_modules script to generate i64 files

  • after the script end, you should see the IDA database files next to each .efi file

Analysing release versions of UEFI images with BinDiff IDA plugin

Check here to get started with BinDiff IDA plugin.

If the plugin is installed:

• open UEFI module in IDA

• File - BinDiff

  • choose .efi.i64 file with similar name from efi_modules directory
  • for example, for DxeCore file choose efi_modules\DxeCore.i64 file

• you can import symbols and comments in Matched Functions window

  

• also you can compare the flow of execution for each function

  

Conclusion

Using this method, you can significantly reduce the time for analysing UEFI images.